AutomatorWP <= 6.0.4 - Unauthenticated Privilege Escalation to Insufficient Role Validation in Anonymous Automation 'Role' Option

Summary

CVE	CVE-2026-104768
State	PUBLISHED
Assigner	Wordfence
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-11-07 12:17:41 UTC
Updated	2026-11-07 12:17:41 UTC
Description	The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.4. This is due to missing privilege-ceiling validation in the `create_user()` function within the anonymous-user action (and equally in the Create User and Add/Change Role WordPress-integration actions), which verify only that the submitted role exists via `automatorwp_get_editable_roles()` without confirming the role falls at or below the acting context's privilege level — allowing attacker-controlled trigger tag data (e.g., a `{comment_author}` tag bound to the Role option) to supply any role, including `administrator`, unchallenged. This makes it possible for unauthenticated attackers to create a new administrator-role account tied to an attacker-controlled email address, receiving the generated password via WordPress's new-user notification email and thereby gaining full administrative access to the site. Exploitation requires the site to have an anonymous automation configured with the Role option bound to a dynamic trigger tag such as `{comment_author}`, and is triggered when a site administrator performs the routine action of approving a comment — an action that provides no in-UI indication that it will mint a new privileged account from the comment author field.

Risk And Classification

Primary CVSS: v3.1 7.5 HIGH from [email protected]

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Problem Types: CWE-269 | CWE-269 CWE-269 Improper Privilege Management

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	7.5	HIGH	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H`
3.1	CNA	DECLARED	7.5	HIGH	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H`

CVSS v3.1 Breakdown

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Rubengc	AutomatorWP No-Code Workflow Automation Integration Webhooks Plugin Now With AI	affected 6.0.4 semver	Not specified

References

Reference	Source	Link	Tags
plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/integrations/automatorwp/actio...	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/integrations/automatorwp/actio...	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/integrations/wordpress/actions...	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/integrations/wordpress/trigger...	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/integrations/wordpress/actions...	[email protected]	plugins.trac.wordpress.org
plugins.trac.wordpress.org/browser/automatorwp/tags/6.0.3/includes/events.php	[email protected]	plugins.trac.wordpress.org
www.wordfence.com/threat-intel/vulnerabilities/id/6138f184-4475-4288-835f-9bf8c...	[email protected]	www.wordfence.com
plugins.trac.wordpress.org/changeset	[email protected]	plugins.trac.wordpress.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: John Ryan Albon (en)

Additional Advisory Data

Source	Time	Event
CNA	2026-11-06T23:15:57.000Z	Disclosed

There are currently no legacy QID mappings associated with this CVE.